I don't understand how this stuff prevents me from MITM:ing the attestation and routing requests to another device that is clean and attested? I.e. how do you know that the remote TPM belongs to the device you're talking to?
The TPM is tamper proof hardware that includes privileged crypto keys that are installed (generated) by the device manufacturer with their identity retained / cataloged. The asymmetry of these privileged keys are where the private/control concerns end up coming from. If these top-level keys were instead unknown to everybody except the device owner (including an enterprise), then there would be no way for a random third party attacker to know whether it was talking to a hardware RPM or a software emulation of one.
Same way drm works, it’s going to be in layer of hw/sw that you don’t have control over. We don’t have commonly have control on the cpu, chipset, uefi. And on the top side things like widevine on the application layer